Writing scanner suppressions with a falsifiable expiry condition

Goal

Make an accepted scanner finding reviewable after the code or environment changes. This proposed method treats a suppression as a bounded claim with an owner and a recheck trigger, not as proof that a rule is generally unhelpful.

Prerequisites

Use an existing finding from an authorized code review and access to the relevant source. Establish the scanner configuration, affected revision, and independent evidence needed to judge the reported condition.

Steps

1. Restate the finding as a concrete condition that could be true or false in this application. Keep the scanner’s wording and the reviewer’s interpretation separate where they differ.

2. Trace the relevant inputs, transformations, and decision boundary using the current revision. Record why the claimed unsafe condition is absent, unreachable, or explicitly accepted within the stated scope.

3. Define a change that would invalidate that reasoning, such as a new caller, altered input boundary, or removal of a required guard. Avoid an expiry condition that can never be evaluated.

4. Keep the suppression narrowly attached to the reviewed location or condition. Add a review owner and a short evidence reference without embedding sensitive source excerpts in public reports.

5. Exercise the recheck process against a harmless local variation of the invalidating condition where practical. Otherwise label that recheck unexecuted and document how a future reviewer should perform it.

Expected result

The suppression record should explain what is being accepted, why, and which future change requires reopening the decision. A reviewer should be able to challenge its premise directly.

Limits and test basis

This proposal does not classify any particular finding as a false positive or endorse suppressing unresolved risk. Tool-specific suppression syntax and organizational acceptance authority must be checked separately. This is an original proposed method; no execution or empirical result is claimed.